109575 matches found
Design/Logic Flaw
An issue in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function...
Juzaweb CMS Injection Vulnerability
Juzaweb CMS is a content management system developed by Juzaweb Individual Developer based on the Laravel framework and Web platform. A security vulnerability exists in Juzaweb CMS v.3.4 and earlier versions, which originated from a vulnerability that allows remote attackers to execute arbitrary...
CVE-2023-40135
In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
Flyte Admin SQL Injection in List Filters
Impact List endpoints on Flyte Admin has a SQL vulnerability where a malicious user can send a REST requests with custom SQL statements as list filters. Workarounds The attacker needs to have access to the flyteadmin installation typically either behind a VPN or authentication. References...
GHSA-R847-6W6H-R8G4 Flyte Admin SQL Injection in List Filters
Impact List endpoints on Flyte Admin has a SQL vulnerability where a malicious user can send a REST requests with custom SQL statements as list filters. Workarounds The attacker needs to have access to the flyteadmin installation typically either behind a VPN or authentication. References...
CVE-2023-46194
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin = 1.7.5 versions...
Cross site scripting
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin = 1.7.5 versions...
CVE-2023-46194 WordPress Archivist – Custom Archive Templates Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin = 1.7.5 versions...
CVE-2023-46194
CVE-2023-46194 – Unauthenticated Reflected XSS in Archivist – Custom Archive Templates (WordPress)
CVE-2023-46194 WordPress Archivist – Custom Archive Templates Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin = 1.7.5 versions...
PT-2023-30037 · Unknown · Juzawebcms
Name of the Vulnerable Software and Affected Versions: juzawebCMS versions 3.4 and earlier Description: An issue in the software allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function. This enables the attacker to potentially gain control over the...
Custom post types <= 5.0.0 - Admin+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Archivist – Custom Archive Templates <= 1.7.5 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-32116
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in TotalPress.Org Custom post types, Custom Fields & more plugin = 4.0.12 versions...
CVE-2023-46077
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin = 2.2.5 versions...
CVE-2023-32116
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in TotalPress.Org Custom post types, Custom Fields & more plugin = 4.0.12 versions...
CVE-2023-46077
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin = 2.2.5 versions...
Cross site scripting
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in TotalPress.Org Custom post types, Custom Fields & more plugin = 4.0.12 versions...
Cross site scripting
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin = 2.2.5 versions...
CVE-2023-32116
CVE-2023-32116 affects the WordPress plugin “TotalPress.Org Custom post types, Custom Fields & more” (versions <= 4.0.12). The root cause is an authenticated stored XSS vulnerability exploitable by users with admin+ privileges; the impact is stored script execution within the plugin’s context ...